Solved: Updating Windows 10 Enterprise 64 from 10074 to 10...

EricNichols · ‎06-25-2015

I kept trying to update from build 10074 to 10130 and it would boot to the recovery wizard. Booting back in to windows it would report error 0x8024001e.

The VM had paravirtual disk controller. I added a second disk on SCSI 2:1 and changed that controller to LSI SAS and booted up and configured the disk. Then I shutdown and changed the paravirtual disk to SAS. Then the update worked fine. Could be a coincidence but I tried half a dozen times before.

Once updated, I changed back to paravirtual and things were fine, at least with boot up.

Trying to log in while View Agent 6.0.2-2331487 or 6.1.1-2769635 were installed results in a BSOD with error DRIVER_IRQL_NOT_LESS_OR_EQUAL (kbdclass.sys). Removing the view agent and Ctrl+Alt+Del works fine but now we cant use horizon view on Windows 10 Tech Preview. So sad.

So sad.

Message was edited by: EricNichols BSOD on Windows 10 10130 with View agent 6.0.2+

EricNichols · ‎07-08-2015

Fixed:

RDP in to the box and edit HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters to put kbdclass before vmkbd

View solution in original post

h3nkY · ‎06-25-2015

Hi Eric,

From attached screenshot, it is clearly the BSOD was triggered by kbdclass.sys which keyboard driver from Microsoft. Usually this is caused by mismatch code execution level in kernel mode (DRIVER_IRQL_NOT_LESS_OR_EQUAL).

To identify what was caused, memory dump is important to see the call stack. It may/may not be caused by API calls in user mode. If possible please attach memory.dmp file which you can find in c:\Windows folder.

EricNichols · ‎06-29-2015

I sent you the google drive link to the memory.dmp. Here is what windbg gave me:

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64

Loading Dump File [D:\MEMORY\MEMORY.DMP]

Kernel Bitmap Dump File: Only kernel address space is available

************* Symbol Path validation summary **************

Response Time (ms) Location

Deferred srv*d:\symbols\*http://msdl.microsoft.com/download/symbols

Symbol search path is: srv*d:\symbols\*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 8 Kernel Version 10130 MP (2 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 10130.0.amd64fre.fbl_impressive.150522-2224

Machine Name:

Kernel base = 0xfffff801`ea88f000 PsLoadedModuleList = 0xfffff801`eabc6cd0

Debug session time: Mon Jun 29 09:06:58.384 2015 (UTC - 7:00)

System Uptime: 0 days 0:08:09.089

Loading Kernel Symbols

...............................................................

................................................................

........................................................

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 1, fffff801bd102a2b}

Probably caused by : kbdclass.sys ( kbdclass!memcpy+2b )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000000000000, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000001, value 0 = read operation, 1 = write operation

Arg4: fffff801bd102a2b, address which referenced memory

Debugging Details:

------------------

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart

unable to get nt!MmSpecialPoolEnd

unable to get nt!MmPagedPoolEnd

unable to get nt!MmNonPagedPoolStart

unable to get nt!MmSizeOfNonPagedPoolInBytes

0000000000000000

CURRENT_IRQL: 2

FAULTING_IP:

kbdclass!memcpy+2b

fffff801`bd102a2b 488941f8 mov qword ptr [rcx-8],rax

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: System

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

DPC_STACK_BASE: FFFFF801EC5F0FB0

TRAP_FRAME: fffff801ec5e95b0 -- (.trap 0xfffff801ec5e95b0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=00000000001d0000 rbx=0000000000000000 rcx=0000000000000008

rdx=ffffe00008955100 rsi=0000000000000000 rdi=0000000000000000

rip=fffff801bd102a2b rsp=fffff801ec5e9748 rbp=fffff801ec5e97c0

r8=000000000000000c r9=0000000000000000 r10=0000000000000038

r11=0000000000000000 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl zr na po nc

kbdclass!memcpy+0x2b:

fffff801`bd102a2b 488941f8 mov qword ptr [rcx-8],rax ds:00000000`00000000=????????????????

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff801eaa0c3a9 to fffff801eaa019a0

STACK_TEXT:

fffff801`ec5e9468 fffff801`eaa0c3a9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx

fffff801`ec5e9470 fffff801`eaa0abc8 : ffffe000`062b3818 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69

fffff801`ec5e95b0 fffff801`bd102a2b : fffff801`bd104b2a 00000000`0000000c fffff801`ec5e97c0 00000000`0000000c : nt!KiPageFault+0x248

fffff801`ec5e9748 fffff801`bd104b2a : 00000000`0000000c fffff801`ec5e97c0 00000000`0000000c fffff801`ec5e97d0 : kbdclass!memcpy+0x2b

fffff801`ec5e9750 fffff801`bd0ba26f : ffffe000`06e79f20 ffffe000`08915190 fffff801`ec5e9878 fffff801`ec5e98d8 : kbdclass!KeyboardClassServiceCallback+0x13a

fffff801`ec5e9800 fffff801`ea8d61ce : fffff801`eac07f00 00000000`00000001 00000000`00000000 fffff801`ec5e9b20 : i8042prt!I8042KeyboardIsrDpc+0x25f

fffff801`ec5e98d0 fffff801`ea8d59ae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExecuteAllDpcs+0x1ae

fffff801`ec5e9a10 fffff801`eaa046fa : fffff801`eac05180 fffff801`eac05180 fffff801`eac7b780 ffffe000`09528080 : nt!KiRetireDpcList+0x13e

fffff801`ec5e9c60 00000000`00000000 : fffff801`ec5ea000 fffff801`ec5e4000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a

STACK_COMMAND: kb

FOLLOWUP_IP:

kbdclass!memcpy+2b

fffff801`bd102a2b 488941f8 mov qword ptr [rcx-8],rax

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: kbdclass!memcpy+2b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: kbdclass

IMAGE_NAME: kbdclass.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 556038b6

BUCKET_ID_FUNC_OFFSET: 2b

FAILURE_BUCKET_ID: AV_kbdclass!memcpy

BUCKET_ID: AV_kbdclass!memcpy

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:av_kbdclass!memcpy

FAILURE_ID_HASH: {dfec7698-3775-c204-13ee-4d0f5bb2791c}

Followup: MachineOwner

---------

andrei_iancu · ‎07-07-2015

I'm facing the same issue. This happened before and what is that i could try reverting to the previous build and it started to work. After i tried to re-run the update and then worked ok.

I am trying to do the same again on the latest build and will update on results.

EricNichols · ‎07-07-2015

Build 10162 exhibits the same problem with kbdclass and Horizon View Agent 6.X. BSOD when Ctrl+Alt+Del/Ins is pressed. This is almost RTM and there is no real response from either MS or VMware. The google drive memory.dmp I sent to h3nkY was never opened and he did not respond to a private message.

Here is the cross post to MS forum http://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_devices/build-10130-enterpris...

EricNichols · ‎07-08-2015

Fixed:

RDP in to the box and edit HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters to put kbdclass before vmkbd

LloydDean99 · ‎09-01-2015

thanks, this worked well.

Easy fix for a change

EricNichols · ‎01-13-2016

This bug just bit me again when updating the view agent.

All

Updating Windows 10 Enterprise 64 from 10074 to 10130 fails with LSI Paravirtual disk & View Agent gives BSOD on Ctrl+Alt+Ins\Del